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DETAILED ACTION 

1 . This Office Action in response to tine Application no. 1 0531 491 filed on 4/1 5/2005 
is entered. 

Claims 32, 33, 34 have been canceled by Preliminary Amendment dated 
4/15/2005. 

Claims 1 - 31 are hence entered and presented for examination. 

Priority 

2. Receipt is acknowledged of papers submitted under 35 U.S.C. 1 19(a)-(d), which 
papers have been placed of record in the file. 

Information Disclosure Statement 

3. The information disclosure statement (IDS) submitted on 4/1 5/2005 was filed, 
and the submission is in compliance with the provisions of 37 CFR 1 .97. Accordingly, 
the information disclosure statement is being considered by the examiner. 

Drawings 

4. The drawings (Fig. 1A, Fig. 1B, Fig. 1C) are objected to because the two 
rectangular boxes connecting the networks VPN 102a, 132, and VPN 104a are not 
labeled with text and are not numbered. The boxes are not described clearly in the 
disclosure. Corrected drawing sheets in compliance with 37 CFR 1 .121(d) are required 
in reply to the Office action to avoid abandonment of the application. Any amended 
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replacement drawing sheet should include all of the figures appearing on the immediate 
prior version of the sheet, even if only one figure is being amended. The figure or figure 
number of an amended drawing should not be labeled as "amended." If a drawing figure 
is to be canceled, the appropriate figure must be removed from the replacement sheet, 
and where necessary, the remaining figures must be renumbered and appropriate 
changes made to the brief description of the several views of the drawings for 
consistency. Additional replacement sheets may be necessary to show the renumbering 
of the remaining figures. Each drawing sheet submitted after the filing date of an 
application must be labeled in the top margin as either "Replacement Sheet" or "New 
Sheet" pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, 
the applicant will be notified and informed of any required corrective action in the next 
Office action. The objection to the drawings will not be held in abeyance. 

The drawings are objected to under 37 CFR 1 .83(a) because they fail to show 
explicitly and clearly the claimed limitations of "means for automatically changing the 
point and "transfer means for" as described in the specification. Any structural 
detail that is essential for a proper understanding of the disclosed invention should be 
shown in the drawing. MPEP § 608.02(d). Corrected drawing sheets in compliance with 
37 CFR 1.121 (d) are required in reply to the Office action to avoid abandonment of the 
application. Any amended replacement drawing sheet should include all of the figures 
appearing on the immediate prior version of the sheet, even if only one figure is being 
amended. The figure or figure number of an amended drawing should not be labeled as 
"amended." If a drawing figure is to be canceled, the appropriate figure must be 
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removed from the replacement sheet, and where necessary, the remaining figures must 
be renumbered and appropriate changes made to the brief description of the several 
views of the drawings for consistency. Additional replacement sheets may be necessary 
to show the renumbering of the remaining figures. Each drawing sheet submitted after 
the filing date of an application must be labeled in the top margin as either 
"Replacement Sheet" or "New Sheet" pursuant to 37 CFR 1.121(d). If the changes are 
not accepted by the examiner, the applicant will be notified and informed of any required 
corrective action in the next Office action. The objection to the drawings will not be held 
in abeyance. 

Specification 

5. The abstract of the disclosure is objected to because the abstract of the 
disclosure does not commence on a separate sheet in accordance with 37 CFR 1 .52 
(b)(4). A new abstract of the disclosure is required and must be presented on a 
separate sheet, apart from any other text. Correction is required. See MPEP 

§ 608.01(b). 

Refer to page 9, the acronym "AAA" should be spelled out in full text. 
Claim Objections 

6. Claims 1 - 31 are objected to because of the following informalities: 
Regarding claim 1 , the claimed subject matter "the network" in line 3, should be 

corrected as "the virtual private network " or "said virtual private network"; "the point" in 
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line 8 should be corrected as "a point"; "the internal portion" in line 9 should be 
corrected as "the internal secured portion" or "said internal secured portion". Appropriate 
correction is required. 

Regarding claims 1 - 27, the claimed subject matter "a network" as stated in the 
preamble should be corrected as "The virtual private network" so as in consistent with 
the limitation claimed in Independent claim 1 . Appropriate correction is required. 

Regarding claim 5, the claimed subject matter "the internal portion" in line 4 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1 . Appropriate 
correction is required. 

Regarding claim 13, the claimed subject matter "the internal portion" in line 3 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1 . Appropriate 
correction is required. 

Regarding claim 15, the claimed subject matter "the internal portion" in line 3 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1 . Appropriate 
correction is required. 

Regarding claim 17, the claimed subject matter "the internal portion" in line 4 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1. Appropriate 
correction is required. 
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Regarding claim 25, the claimed subject matter "the internal portion" in line 2 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1. Appropriate 
correction is required. 

Regarding claim 27, the claimed subject matter "the internal portion" in line 2 
should be corrected as "the internal secured portion" or "said internal secured portion" 
so as in consistent with the limitation claimed in Independent claim 1. Appropriate 
correction is required. 

Regarding claim 28, the claimed subject matter "an internal portion" in line 3 
should be corrected as "an internal secured portion", and "the internal portion" should 
also be corrected "the internal secured portion" or "said internal secured portion" so as 
in consistent with the claimed limitations by the other claims, and "the point" should be 
corrected as "a point". Appropriate correction is required. 

Regarding claim 29, the claimed subject matter "the internal portion" in line 6 
should be corrected as "the internal secured portion" so as in consistent with previous 
claimed limitation. Appropriate correction is required. 

Regarding claim 30, the claimed subject matter "the internal portion" in line 3 
should be corrected as "the internal secured portion" so as in consistent with previous 
claimed limitation. The claimed subject matter "A mobile workstation" should be 
corrected as "The virtual private network", and the ";" at the end of the second gateway 
should be replaced with ".". Appropriate correction is required. 
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Regarding claim 31, the claimed subject matter "the internal portion" in line 3 
should be corrected as "the internal secured portion" so as in consistent with previous 
claimed limitation. The claimed subject matter "A mobile workstation" should be 
corrected as "The virtual private network", and the ";" at the end of the second gateway 
should be replaced with ".". Appropriate correction is required. 

Claim Rejections - 35 USC §112 

7. The following is a quotation of the second paragraph of 35 U.S.C. 1 1 2: 

The specification sliall conclude witli one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claim 1 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. It is not clear to one of ordinary skill in the art that what is 
being claimed by the applicant "means for", since no function is specified by the word(s) 
preceding "means," it is impossible to determine the equivalents of the element, and the 
claimed subject matter "means for ..." does not describe clearly and explicitly in the 
specification and the limitation also does not show or illustrate clearly in the drawing. 

Claim 2 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. It is not clear to one of ordinary skill in the art that the claimed 
subject matter "a gateway" is referred to the first gateway or to a new gateway. 
Clarification is required. 
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Claim 4 recites the limitation "the home address" in lines 1 - 2. There is 
insufficient antecedent basis for this limitation in the claim. 

Claim 1 1 recites the limitation "the address of the second gateway" in lines 2-3. 
There is insufficient antecedent basis for this limitation in the claim. 

Claim 17 recites the limitation "the location of the mobile station" in lines 2-3. 
There is insufficient antecedent basis for this limitation in the claim. 

Claim 18 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. It is not clear to one of ordinary skill in the art that the claimed 
subject matter "the gateway" is referred to the first gateway or to a better gateway. 
Clarification is required. 

Claim 20 recites the limitation "the care-of-address" in lines 1 - 2. There is 
insufficient antecedent basis for this limitation in the claim. 

Claim 28 recites the limitation "the route" in line 1 . There is insufficient 
antecedent basis for this limitation in the claim. 

Claim 29 recites the limitation "via the first secure communication means" in line 
4. There is insufficient antecedent basis for this limitation in the claim. 

Claim 29 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. It is not clear to one of ordinary skill in the art that what is 
being claimed by the applicant "means for", since no function is specified by the word(s) 
preceding "means," it is impossible to determine the equivalents of the element, and the 
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claimed subject matter "means for ..." does not describe clearly and explicitly in the 
specification and the limitation also does not show or illustrate clearly in the drawing. 

Claims 30, 31 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. It is not clear to one of ordinary skill in the art that 
what is being claimed by the applicant "means for", since no function is specified by the 
word(s) preceding "means," it is impossible to determine the equivalents of the element, 
and the claimed subject matter "means for ..." does not describe clearly and explicitly in 
the specification and the limitation also does not show or illustrate clearly in the drawing. 

Claims 30, 31 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. Claims 30 and 31 appear to be an apparatus, which 
should constitute device or apparatus; however, the claims are dependent upon 
independent claim 1 which claimed a virtual private network. It is not clear to one of 
ordinary skill in the art that what is being claimed by the applicant is it the claimed 
subject matter "a virtual private network" or "a mobile workstation". Clarification is 
required. 

Claim 30 recites the limitation "the identifier of the second gateway" in line 4. 
There is insufficient antecedent basis for this limitation in the claim. 



Claim Rejections - 35 USC § 102 
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8. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 1 22(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

9. Claims 1 - 13, 15, 17-31 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Kakemizu et al. (US 20020018456 A1). 

Regarding claim 1, Kakemizu et al. disclose a virtual private network including an 
internal secured portion which connects via at least a first gateway and a second 
gateway to an external portion (Fig. 2, "element 21 VPNGW(FA)" interpreted as a first 
gateway, "element 31 VPNGW(HA)" interpreted as a second gateway, "VPN of IP sec." 
interpreted as internal secured portion, "public IP network" interpreted as an external 
portion; Fig. 2, paragraph [0017], Fig. 25, paragraphs [0113] ), the network comprising: 
a plurality of workstations including at least one mobile workstation in the external 
portion ("element MN 1" interpreted as at least one mobile workstation in the external 
portion; paragraph [0017]); the first gateway (Fig. 2, "element 21 VPNGW(FA)" 
interpreted as the first gateway; paragraph [0017]); the second gateway (Fig. 2, 
"element 31 VPNGW(HA)" interpreted as the second gateway; paragraph [0017]); and 
means for automatically changing the point through which the mobile workstation 
communicates with the internal portion of the network from the first gateway to the 
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second gateway, in response to movement of the mobile workstation (Fig. 5, paragraph 
[0113]). 

Regarding claim 2, Kakemizu et al. disclose a network as claimed further 
comprising transfer means for transferring context information usable by a gateway in 
communications with the mobile workstation, to the second gateway (Fig. 25, 
paragraphs [0114], [0115]). 

Regarding claim 3, Kakemizu et al. disclose a network as claimed wherein the 
context Information includes an identifier of the mobile workstation ("care-of-address" 
interpreted as context information includes an identifier of the mobile workstation; 
paragraphs [0004], [0100]). 

Regarding claim 4, Kakemizu et al. disclose a network as claimed wherein the 
identifier is the home address of the mobile workstation ("home address"; paragraphs 
[0004], [0100]). 

Regarding claim 5, Kakemizu et al. disclose a network as claimed wherein the 
context Information includes material for defining secure communication means by 
which information is transferable securely between the mobile workstation in the 
external portion of the network and the internal portion of the network, via the 
second gateway (paragraphs [0017], [0024], Fig. 2, Fig. 27). 
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Regarding claim 6, Kakemizu et al. disclose a network as claimed wherein the 
secure communication means is a security association pair between the second 
gateway and the mobile workstation (Fig. 27, "position registration request message 
(HAR), and "position registration response (HAA)" interpreted as secure communication 
means is a security association pair; paragraphs [0128], [0129). 

Regarding claim 7, Kakemizu et al. disclose a network as claimed wherein the 

transfer means is physically separate from the first gateway ( "element 23 AAAF" 
interpreted as the transfer means; Fig. 27, paragraphs [0127], [0129]). 

Regarding claim 8, Kakemizu et al. disclose a network as claimed wherein the 

transfer means additionally transfers information to the mobile workstation for enabling 
communications between the mobile workstation and the second gateway (Fig. 27, 
paragraph [0129]). 

Regarding claim 9, Kakemizu et al. disclose a network as claimed wherein the 
information transferred to the mobile workstation enables secure communication means 
by which information is transferable securely between the mobile workstation in the 
external portion of the network and the internal portion of the network, via the second 
gateway ("elements "Reg Req 1 , and Reg Rep 8 and authentication request message , 
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AMR" interpreted as the information transferred to tlie mobile worl<station enables 
secure communication means; Fig. 27, paragraphs [0127]-[0129]). 

Regarding claim 10, Kakemizu et al. disclose a network as claimed wherein the 
secure communication means is a security association pair between the mobile 
workstation and the second gateway (Fig. 27, "position registration request message 
(HAR), and "position registration response (HAA)" interpreted as secure communication 
means is a security association pair; paragraphs [0128], [0129]). 

Regarding claim 1 1 , Kakemizu et al. disclose a network as claimed wherein the 
information transferred to the mobile workstation comprises the address of the second 
gateway (Fig. 27, paragraph [0128]). 

Regarding claim 12, Kakemizu et al. disclose a network as claimed wherein the 
information transferred to the mobile workstation is transferred between the first 
gateway and the mobile workstation using an existing security association between the 
mobile workstation and the first gateway (elements "Reg Req 1 , and Reg Rep 8 and 
authentication request message , AMR" interpreted as the information transferred to the 
mobile workstation is transferred between the first gateway and the mobile workstation; 
Fig. 27, paragraphs [0127]-[0129]). 



Application/Control Number: 1 0/531 ,491 Page 1 4 

Art Unit: 2619 

Regarding claims 13, 15, Kakemizu et al. disclose a network as claimed wherein 
the second gateway comprises one or more databases which are updated to enable the 
internal portion of the network and the mobile workstation in the external portion of the 
network to communicate via the second gateway ("element 34 VPN database"; Fig. 27, 
paragraphs [0128], [0129]). 

Regarding claim 17, Kakemizu et al. disclose a network as claimed further 
comprising location detection means for detecting the location of the mobile 
workstation and initiating a change in the point through which the mobile 
workstation communicates with the internal portion of the network, from the first 
gateway to a better gateway (element 33 AAAH" interpreted as the location detection 
means; Fig. 25, Fig.26, paragraphs [0119]-[0121). 

Regarding claim 18, Kakemizu et al. disclose a network as claimed wherein the 
gateway is better because it is closer to the mobile workstation and/or it is optimal for 
routing existing sessions (Fig. 13, paragraphs [0080], [0081]). 
Regarding claim 19, Kakemizu et al. disclose a network as claimed wherein the 
detection means is responsive to a location identifier received from the mobile 
workstation (paragraphs [0128], [0100]). 
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Regarding claim 20, Kakemizu et al. disclose a network as claimed wherein the 
location identifier is the care-of-address of the mobile workstation ("care-of-address"; 
paragraph [0100]). 

Regarding claim 21 , Kakemizu et al. disclose a network as claimed wherein the 
identifier is received during a mobility binding update (Fig. 20, "mobility binding"; 
paragraphs 0098], [0101]). 

Regarding claim 22, Kakemizu et al. disclose a network as claimed wherein the 
location detection means is separate from the first gateway ("element 33 AAAH" 
interpreted as the location detection means is separate from the first gateway 
(VPHGW(HA) interpreted as first gateway); Fig. 25, Fig.26, paragraphs [01 19]-[0121]). 

Regarding claim 23, Kakemizu et al. disclose a network as claimed wherein the 
transfer means is physically separate from the first gateway and wherein the location 
detection means and transfer means are housed together (Fig. 6, paragraphs [0071], 
[0072]). 

Regarding claim 24, Kakemizu et al. disclose a network as claimed wherein 
the first gateway and the second gateway are in distinct physically separated 
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segments of the network (VPNGW(FA) interpreted as first gateway wliicli is located at 
roaming-contracted ISP network, and VPNGW(HA) interpreted as second gateway 
which is located at HOME ISP; Fig. 25, Fig. 26). 

Regarding claim 25, Kakemizu et al. disclose a network as claimed wherein 
the mobile workstation communicates with the internal portion of the network via 
the first gateway and also via the second gateway simultaneously for a transition 
period, before communicating via the second gateway only (Fig. 26, paragraphs [0120]- 
[0121]). 

Regarding claim 26, Kakemizu et al. disclose a network as claimed wherein 
the mobile workstation is involved in a session with a correspondent node (paragraph 
[0128]). 

Regarding claim 27, Kakemizu et al. disclose a network as claimed wherein the 
correspondent node is located in the internal portion of the network and the mobile 
workstation is located in the external portion of the network ("CN" interpreted as 
correspondent node is located in the internal portion of the network; "MN 1" interpreted 
as the mobile workstation is located in the external portion of the network; Fig. 2, Fig. 
26). 
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Regarding claim 28, Kakemizu et al. disclose a method of optimizing the route by 
which information travels between a mobile node in an external portion of a network and 
a correspondent node in an internal portion of a network (Fig. 13, paragraph [0080]), 
comprising the steps of: determining when a first serving gateway through which the 
mobile node communicates with the internal portion of the network, is sub-optimal (Fig. 
13, paragraph [0081]); identifying a second gateway; and transferring the point through 
which the mobile node communicates with the internal portion of the network from the 
first serving gateway to the second gateway (paragraph [0082]). 

Regarding claim 29, Kakemizu et al. disclose a mobile workstation for connecting 
to an external portion of a network that includes an internal secured portion connected, 
via a first gateway and a second gateway to the external portion (Fig. 2, "element 21 
VPNGW(FA)" interpreted as a first gateway, "element 31 VPNGW(HA)" interpreted as a 
second gateway, "VPN of IP sec." interpreted as internal secured portion, "public IP 
network" interpreted as an external portion; Fig. 2, paragraph [0017], Fig. 25, 
paragraphs [01 13] ), comprising: means arranged to receive, via the first secure 
communication means, an identifier of a second gateway ( Fig. 27, paragraph [0128]); 
and means arranged to change from communicating with the internal portion of the 
network through the first gateway to communicating via the second gateway (Fig. 27, 
paragraphs [0128]-[0129]). 
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Regarding claim 30, Kal<emizu et al. disclose a mobile workstation as claimed 
further comprising means for using a first secure communication means by which 
information is transferable securely between the internal portion of the network and the 
mobile workstation via the first gateway, to receive the identifier of the second gateway 
(elements "Reg Req 1, and Reg Rep 8 and authentication request message , AMR" 
interpreted as the information transferred to the mobile workstation is transferred 
between the first gateway and the mobile workstation; Fig. 27, paragraphs [0127]- 
[0129]); 

Regarding claim 31, Kakemizu et al. discloses a mobile workstation as claimed 
further comprising means for using a second secure communication means to 
transfer information securely between the internal portion of the network and the 
mobile workstation via the second gateway (Fig. 27, "position registration request 
message (HAR), and "position registration response (HAA)" interpreted as means for 
using a second secure communication means; paragraphs [0128], [0129]). 

Claim Rejections - 35 USC § 103 

1 0. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or deschbed as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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1 1 . Claims 14, 16 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kakemizu et al. (US 20020018456 A1) in view of Shapira et al. (US 7107464 B2). 

Regarding claims 14, 16, Kakemizu et al. disclose a network as claimed wherein 
the second gateway comprises one or more databases ("element 34 VPN database"; 
Fig. 27, paragraphs [0128], [0129]). 

Kakemizu et al. do not disclose explicitly wherein the one or more databases are 
a Security Policy Database and a Security Association Database. 

Shapira et al. in the same field of endeavor teach wherein the one or more 
databases are a Security Policy Database and a Security Association Database ("a 
security association database (SAD)"; col. 6, lines 47 - 54, "Security Policy Database 
(SPD)";col. 14, lines 39-48). 

At time the invention was made it would have been obvious to a person of 
ordinary skill in the art to modify the teachings of Kakemizu et al. to include the features 
of wherein the one or more databases are a Security Policy Database and a Security 
Association Database as taught by Shapira et al. One of ordinary skill in the art would 
be motivated to do so for providing a mechanism for implementing virtual private 
networks (VPNs) incorporating a security association database and associated 
processor (as suggested by Shapira et al., see col. 1 , lines 8-11). 

Conclusion 

12. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 



Application/Control Number: 1 0/531 ,491 Page 20 

Art Unit: 2619 

a) Jingetal. (US 7298847 B2). 

b) Xu etal. (US 6738362 B1). 

c) Amin etal. (US 6714987 B1). 

1 3. Any inquiry concerning tliis communication or earlier communications from the 
examiner should be directed to Andrew C. Lee whose telephone number is (571 )272- 
3131 . The examiner can normally be reached on Monday through Friday from 8:30am - 
5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Edan Orgad can be reached on (571) 272-7884. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Examiner, Art Unit 2619 
<8/28/2008> 
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